Outsourced manufacturing put quality responsibility in two organizations and accountability in one. Regulators are consistent on the point: a sponsor that outsources manufacturing does not outsource responsibility for product quality. The quality agreement is the instrument that makes the split explicit, and it is expected to exist, to be current, and to reflect what actually happens on the floor.
Most quality agreements are drafted competently. Quality assurance leads know what belongs in them, and templates circulate widely. The gap is not in the drafting. It is that the executed agreement is filed in a quality management system while the commercial supply agreement sits in legal, the two are amended on different cycles, and neither one generates a task when a change notification window is missed.
This guide covers what a CMO quality agreement has to allocate, where the commitments break in practice, and how to convert the document into tracked obligations that surface before an inspector finds them.
What the quality agreement has to allocate
A quality agreement is fundamentally a responsibility allocation. Regulatory guidance across major markets converges on the same functional areas, and each one needs a named accountable party rather than a shared one.
- Manufacturing and process control, which party owns the master batch record, process validation, equipment qualification and the environmental monitoring program at each site.
- Testing and release, who performs which analytical testing, who holds the retained samples, and which party executes final release for the market in question.
- Deviation and investigation handling, the threshold that triggers notification to the sponsor, the window for that notification, and who owns closure of the investigation.
- Change control, the categories of change requiring prior written approval, those requiring notification only, and the lead time for each, which is the term most often breached.
- Records, retention and audit rights, record retention periods, data integrity expectations under 21 CFR Part 11, and the sponsor right to audit including for-cause access.
The functional content is well understood. What varies enormously between organizations is whether the responsibility matrix names a role on every line. A matrix that says sponsor and CMO without identifying the accountable function is an allocation that will be reinterpreted during the first serious deviation, usually under time pressure.
Keep the quality agreement legally distinct from the commercial supply agreement, as regulators expect, but link them as records so that a change to supply scope, site or term surfaces the quality agreement for review. Separation of documents should not mean separation of visibility.
Where quality agreements break after signature
The failure modes are operational rather than legal, and they share a common root: the commitments in the document are not represented anywhere that generates work.
- Change notification windows go untracked. The agreement gives the CMO a defined lead time to notify a change in supplier, site, process or specification. Nothing in either organization monitors whether that window was honored until a regulatory question forces a reconstruction.
- The responsibility matrix ages. Sites move, testing is subcontracted, and analytical methods transfer. The matrix stays as executed for years, so the document describes a supply arrangement that no longer exists.
- Audit rights are never scheduled. The right to audit is negotiated carefully and then not exercised on any cadence. When a for-cause audit is finally needed, the access terms and notice periods have to be rediscovered from the document.
- Subcontracting is unmonitored. Most agreements require approval before a CMO subcontracts a GxP activity. Very few organizations track the approved subcontractor list against what is actually happening at tier two.
- Amendments diverge. The commercial agreement is amended for price and volume while the quality agreement is not amended at all, leaving quality terms that reference sites or products no longer in scope.
A five-step operating model
Step 1, Build the responsibility matrix with named roles
Rewrite the matrix so every line carries an accountable function on each side, not just an organization name. Where responsibility is genuinely shared, say what each party does rather than leaving the line joint.
Step 2, Extract the notification and approval terms as obligations
Pull every commitment with a time element out of the document and represent it as a tracked obligation with an owner, a trigger and a due window. Change notification lead times, deviation reporting thresholds and annual product review timing are the priority set.
Step 3, Link the quality and commercial agreements as records
Create a record relationship so that a supply agreement amendment, site addition or product transfer automatically raises a quality agreement review task. This single link removes most divergence.
Step 4, Schedule audits and requalification on the record
Put the audit cadence, the last audit date and the requalification due date on the same record as the audit rights. A right with no schedule is a right that expires quietly.
Step 5, Review the matrix on a fixed cadence and on trigger
Set an annual review of the responsibility matrix, plus event triggers for site change, method transfer, subcontractor addition and any critical deviation. Record the review outcome even when nothing changes, because an inspector will ask.
See quality commitments tracked as obligations
Aavenir Obligationflow converts change notification windows, audit cadences and requalification dates into owned, dated tasks with an evidence trail.
Why change control is the term worth instrumenting first
If a quality organization can only instrument one part of the agreement, it should be change control. Unannounced or late-notified changes to a manufacturing site, a raw material supplier, an analytical method or a specification are the category most likely to produce a regulatory finding, a supply interruption or a product impact assessment executed under pressure. The agreement usually states the notification lead time clearly, which makes the commitment easy to express as a rule: a change of category A requires written approval no fewer than a defined number of days before implementation, owned by a named function on both sides. Once that rule exists as a tracked obligation, late notification becomes an exception that appears on a report rather than a fact discovered during an inspection. The same logic applies to annual product quality review timing and to deviation notification thresholds, both of which are date-bound and both of which are commonly reconstructed after the fact. Broader patterns for this are covered in obligation management for life sciences.
Commercial supply agreement or quality agreement
Confusion about which document governs a term is a recurring source of dispute during a deviation. The table below reflects common practice rather than a legal rule, and the allocation should be stated explicitly in both documents.
| Term | Usually commercial agreement | Usually quality agreement | Failure mode when unclear |
|---|---|---|---|
| Price, volume and forecast | Yes | No | Quality scope silently exceeds contracted capacity |
| Batch release responsibility | No | Yes | Release performed by a party without documented authority |
| Change notification lead time | No | Yes | Change implemented before sponsor assessment |
| Liability and indemnity | Yes | No | Quality document creates unintended liability positions |
| Audit and inspection access | Reference only | Yes | Access disputed during a for-cause audit |
A CMO quality agreement is a control document, and controls that generate no work are not controls. The organizations that hold up under inspection are the ones where the responsibility matrix names roles, the notification windows exist as dated obligations with owners, and a change to the commercial arrangement raises a quality review automatically. For the wider set of GxP evidence a system should produce, see the 21 CFR Part 11 and GxP audit checklist.
For related guidance, see The quality leader’s guide to pharma quality agreements, The quality leader’s guide to CDMO quality agreements and Quality agreement obligations, who tracks what in GxP.
