Most marketing applications rest partly on technical information the applicant has never read. The manufacturing detail for an active ingredient sits in the supplier's master file, and the applicant references it with the supplier's permission. That permission arrives as a letter of authorization: short, standard and consequential. It tells the regulator it may review the file in support of a named application.
What the letter does not do is commit the supplier to anything beyond granting access. It does not promise the file is current. It does not require notice before a manufacturing change. It does not oblige the supplier to respond when the regulator raises a deficiency against the referenced content, and it does not address what happens if the supplier is acquired or stops supporting the file. Every one of those is a live risk to the applicant's filing.
Those obligations have to come from the supply or quality agreement. The letter of authorization is the visible artefact; the contract is where the dependency is actually managed. Treating the two as one document is how applicants discover, during a review cycle, that they have permission without protection.
Five dependencies the letter does not cover
The reference creates a structural asymmetry: the applicant carries regulatory accountability for content it cannot inspect. Each dependency below needs a contractual counterpart, and each is a common finding when a filing runs into trouble.
- Change notification, a supplier can alter a process, site or specification and update the file without telling the applicant, whose own filing may require a variation.
- File currency, the applicant cannot verify that the file is complete, current or free of outstanding regulatory correspondence, and a deficient file becomes the applicant's review problem.
- Deficiency response, when a regulator queries the referenced content, only the holder can answer, and an unhurried response delays the applicant's approval.
- Withdrawal and support, a holder who withdraws the file or stops maintaining it leaves the applicant to requalify an alternative source under time pressure.
- Successor and assignment, an acquisition can change who holds the file, and without successor obligations the new holder inherits no commitment to the applicant.
These are not hypothetical. Each has a straightforward contractual answer, and in practice the answer is often missing because the supply agreement was negotiated on price, volume and delivery terms while the regulatory dependency was treated as settled by the letter of authorization alone.
Regulators hold the applicant responsible for the quality of its application, including the portions supported by reference to another party's master file. The applicant cannot audit that content directly. The practical consequence is that contractual notification, support and continuity obligations are not commercial niceties, they are the applicant's only instrument for managing a dependency it is answerable for.
What to hold on the contract record
Five tracked elements make the dependency visible and manageable. Each should sit on the supplier contract record with an owner and a review cadence, not in a regulatory affairs folder.
- Letter of authorization register. the current letter for each referenced file, the material and application it covers, its date, and a link to the agreement that obliges the supplier to maintain it.
- Change notification terms. the notice period for process, site, specification and supplier changes, with the categories defined so that a change requiring a variation cannot be classified as minor unilaterally.
- Support and response commitment. an obligation to support deficiency responses within a defined period, tracked as a dated duty when a query is raised rather than negotiated at the point of urgency.
- Continuity and withdrawal notice. a minimum notice period before the holder ceases to maintain or support the file, long enough to qualify an alternative source.
- Successor obligations. an express requirement that assignment or transfer of the file carries the applicant's rights and the supplier's duties to the successor holder.
A five-step roadmap to close the exposure
Step 1, Inventory every reference
Establish which applications depend on which master files, held by which suppliers, for which materials. The list is usually incomplete because references accumulate across products and years. Build it from the applications rather than from supplier records, since a supplier may hold several files and only some are referenced.
Step 2, Match each reference to its agreement
For every reference, identify the supply or quality agreement with the holder and check whether it contains notification, support, continuity and successor terms. Record the result. References with no supporting agreement, or with an agreement silent on these points, are the priority exposures.
Step 3, Define change categories contractually
Vague notification terms fail in practice because the supplier classifies its own changes. Specify the change categories that trigger notice, the notice period for each, and the applicant's right to assess regulatory impact before implementation. Tie the definitions to the quality agreement where one exists, since these are the same quality agreement obligations pharma teams keep missing.
Step 4, Make support obligations dated
Convert the deficiency support commitment into a tracked obligation: when a regulatory query touches referenced content, the supplier's response window starts and is monitored. Without a start-stop mechanism the commitment is an intention, and the applicant absorbs the schedule risk.
Step 5, Review letters and terms on a cycle
Letters of authorization go stale, applications change scope, and suppliers reorganize. Review the register periodically against current applications, confirm each letter is still valid for its stated scope, and refresh terms at renewal rather than at the point a problem appears, applying the same evidence discipline as a 21 CFR Part 11 and GxP audit checklist.
Hold the reference dependency on the contract
Aavenir tracks letters of authorization, change notification windows and support commitments as monitored obligations on the supplier agreement.
Where this surfaces in practice
Two moments expose the gap. The first is a review cycle, when a regulator raises a deficiency against referenced content and the applicant discovers it has no contractual lever to compel a timely response. The second is a supplier change, when a site transfer or process modification reaches the applicant after implementation and triggers an unplanned variation. Both are predictable, both are addressable in drafting, and both are substantially cheaper to handle at negotiation than in a review clock. The organizations that handle them well are generally the ones that treat the letter of authorization as an index entry pointing at a contract, rather than as the control itself.
Dependency, contractual answer and evidence
The table sets out each dependency, the term that addresses it, and the record that demonstrates the control is operating.
| Dependency | Contractual term | Tracked as | Evidence retained |
|---|---|---|---|
| Undisclosed supplier change | Change notification with categories | Notice window per change type | Notification record, impact assessment |
| Stale or deficient file | File maintenance obligation | Periodic confirmation | Supplier confirmation, letter date |
| Slow deficiency response | Support commitment with period | Dated obligation on query | Query date, response date |
| File withdrawal | Minimum continuity notice | Notice period monitored | Withdrawal notice, requalification plan |
| Holder changes hands | Successor and assignment terms | Reviewed at any transfer | Successor acknowledgement |
A right of reference is an efficient arrangement that lets suppliers protect proprietary process detail while applicants build filings on it. The inefficiency is in how the dependency gets managed. A letter of authorization grants access and nothing more, yet it is routinely treated as if it settled the relationship. The obligations that keep a filing supportable, notice before change, support during review, continuity of the file and the survival of both through a transfer, are supply agreement terms. Registering each reference, matching it to its agreement, and tracking the notification and support windows as live obligations converts an invisible dependency into one the applicant can actually manage.
For related guidance, see The quality leader’s guide to CDMO quality agreements, The sponsor’s guide to CRO master service agreements and Quality agreement tracking for sponsors and CDMOs.
