A quality agreement is the document that says who is responsible for what when a regulated activity is performed by someone other than the license holder. It is not a commercial document and it is not optional. Regulators expect the responsibility allocation to be explicit, current and traceable, and they expect the license holder to be able to demonstrate oversight of the activities it delegated.
In practice, most quality agreements are negotiated carefully, signed, filed in a quality management system, and then left alone until the next periodic review or the next inspection. Meanwhile the commercial relationship changes. New products are added to the scope. The supplier subcontracts a testing step. A site moves. The agreement still describes the original arrangement, and nobody has noticed that the description no longer matches what is happening.
The gap between a signed quality agreement and a tracked one is where most supplier oversight findings originate. This article covers the obligations that fail quietly, why calendar-based review does not catch them, and the tracking structure that keeps the responsibility matrix aligned with the operating relationship.
The obligations that fail quietly
Some quality agreement commitments announce themselves when breached. A missed batch release is visible immediately. Others fail silently and are discovered months later, usually by an auditor rather than by the quality organization.
- Change notification windows, the supplier commits to notify before changing a process, material, site or specification, and the window is often thirty to ninety days, which means a late notification is a breach that arrives as a fait accompli
- Subcontracting consent, the agreement usually requires written consent before any GxP activity is subcontracted, and this is the clause most commonly breached because the supplier treats a testing lab as a routine service purchase
- Deviation and complaint reporting clocks, reporting obligations measured in hours or business days are frequently written into the agreement and tracked nowhere, so compliance depends on the individual handling the event
- Annual product review inputs, the supplier owes data on a defined cadence, and late or incomplete submissions compress the license holder’s own review timeline without triggering any alert
- Record and sample retention on exit, retention obligations survive termination by years, and they are routinely lost when the commercial relationship ends and the account team disperses
What these have in common is that none of them generates a transaction. There is no invoice, no purchase order, no shipment to trigger a review. They only surface when someone asks the question, which is why they show up in audit findings rather than in operational reporting. A quality agreement stored as a document has no mechanism to ask the question on a schedule.
Suppliers subcontract routinely and often do not classify a testing, packaging or storage vendor as a GxP subcontractor requiring consent. Where the agreement requires prior written approval, the license holder should hold a current list of approved subcontractors per supplier and reconcile it during every audit, rather than relying on the supplier to raise the question.
Why periodic review does not close the gap
Most quality organizations review supplier agreements on a fixed cycle, commonly every two or three years. The cycle is necessary and insufficient, for reasons that are structural rather than procedural.
- Change arrives between cycles. A scope change, a site transfer or a new product addition happens on the commercial calendar, not the quality review calendar, and the agreement is stale from that day forward
- Review is document-level, not obligation-level. A periodic review confirms the agreement is still in force. It rarely walks each obligation and confirms it is still being met by a named party
- The trigger is missing. Nothing in the commercial process prompts a quality agreement review when a work order changes scope, which is the single most common cause of drift
- Ownership is ambiguous. Obligations are written against organizations, not roles. When the named function reorganizes, the obligation has no owner and no escalation path
- Exit obligations outlive the reviewer. Retention, return and destruction duties extend past the relationship and past the tenure of everyone who negotiated them, so they need a system record rather than institutional memory
A five-step approach to live tracking
Step 1, Extract obligations rather than filing agreements
Pull each commitment out of the executed quality agreement as a discrete record with a party, a trigger, a clock and a consequence. Extraction models handle the first pass across a supplier portfolio, and quality reviews the exceptions rather than reading every agreement.
Step 2, Assign obligations to roles, not names
Map each obligation to a role in the quality organization with a defined escalation path. Roles survive reorganizations and departures, which is what keeps an obligation owned when the individual who negotiated it moves on.
Step 3, Wire commercial change to quality review
Make any change to scope, site, product list or subcontractor in the commercial record trigger a quality agreement review task. This single control removes most of the drift that periodic review is expected to catch and does not.
Step 4, Automate the clocks
Reporting windows, notification periods and data submission cadences should generate alerts before they expire, escalating on breach. Calendar reminders held by individuals are not a control, because they fail exactly when the individual is unavailable.
Step 5, Maintain the approved subcontractor list
Hold a current list per supplier, reconcile it at each audit, and treat any unlisted GxP activity as a finding. This converts subcontracting consent from a clause into a checkable state.
See obligation extraction on a real quality agreement
Walk through how commitments, clocks and responsibility allocation resolve into monitored records with owners.
What good oversight evidence looks like
Demonstrating oversight is not the same as having a signed agreement. Inspectors and auditors look for evidence that the license holder knew what was delegated, monitored whether it was performed, and acted when it was not. In practice that means being able to produce the current responsibility matrix for a named supplier and activity, the record of change notifications received and assessed, evidence that reporting clocks were met for a sample of events, the approved subcontractor list with dates of approval, and the audit history with findings and closure. Every one of those is a query against structured data if obligations were extracted, and a document reconstruction exercise if they were not. The difference is usually days of preparation per supplier, and it compounds across a portfolio. The same logic underpins broader obligation management in life sciences, where the contract record and the quality record have to reconcile.
Obligation types and the control each needs
The table maps the common quality agreement obligation types to their owner, the clock that governs them, and the failure that follows when they are untracked.
| Obligation | Typical owner | Clock | Failure when untracked |
|---|---|---|---|
| Change notification | Supplier quality lead | 30 to 90 days before change | Unassessed change reaches product |
| Subcontracting consent | Supplier quality lead | Prior written approval | Unqualified GxP activity in the chain |
| Deviation reporting | Quality assurance | Hours to business days | Late assessment, escalated finding |
| Annual product review data | Supplier account owner | Defined annual cadence | Compressed internal review timeline |
| Record and sample retention | Quality records owner | Years past termination | Records unavailable at inspection |
Quality agreements do not fail because they are badly written. They fail because they are treated as documents rather than as sets of live commitments with owners and clocks. Extracting the obligations, assigning them to roles, connecting commercial change to quality review and automating the reporting windows turns the agreement into something that can be monitored continuously. That is the difference between asserting oversight and evidencing it, and it is the difference an auditor is trained to look for.
For related guidance, see Quality agreement obligations, who tracks what in GxP, The quality leader’s guide to CMO quality agreements and The quality leader’s guide to CDMO quality agreements.
