Pharma contract manufacturing risk rarely announces itself at signing. It builds during the years between renewals, while the quality agreement that governs a CDMO relationship sits untouched in a file. The direct answer: most pharma companies renew contract manufacturing agreements based on the CDMO’s compliance standing at the last inspection, not its current one, and FDA enforcement data shows that gap is where the real exposure sits.
Contract manufacturing facilities now account for roughly 40% of warning letters FDA issues for GMP violations, and FDA warning letter volume surged 50% in FY2025 compared with the prior year. For a sponsor company, a warning letter at a CDMO isn’t someone else’s problem. FDA has said plainly in recent letters that it regards contractors as extensions of the manufacturer, meaning the brand on the label carries the liability even when the violation happened on someone else’s production floor.
Why Quality Agreements Go Stale Between Renewals
A quality agreement is supposed to be a living document spelling out who releases batches, who handles deviations, and who owns change control when a process shifts. In practice, most get signed once at the start of a manufacturing relationship and reopened only when the contract itself comes up for renewal, sometimes three or five years later.
FDA’s own guidance on contract manufacturing arrangements exists because this gap is so common. The agency flags incomplete or outdated quality agreements as a recurring inspection finding, and change control is one of the most frequent gaps: a CDMO adjusts a process or testing method, and the paperwork governing that decision never catches up.
That lag matters more now. More than half of the CGMP warning letters FDA issued to pharma manufacturers in 2025 cited component identity testing failures under 21 CFR 211.84(d)(1), and the same analysis found pronounced regional disparities in data integrity findings, with facilities in India showing disproportionately high rates. A sponsor relying on a three-year-old risk assessment has no way of knowing whether that facility’s quality culture has held up since.
The Evidence: Enforcement Is Concentrating on Contract Manufacturers
None of this happens in isolation from the broader supply picture. FDA’s Drug Shortages database is updated daily because manufacturing disruptions, including quality failures at contract sites, move faster than the reporting cycles built around them. A shortage tied to a CDMO quality issue can surface with little warning if the sponsor’s last real look at that facility was the original qualification audit.
The regulatory framework has also shifted toward continuous risk management over point-in-time review. The ICH Q9(R1) guideline on quality risk management, adopted by both FDA and the European Medicines Agency, directs sponsors to size the formality of their oversight to the actual level of risk rather than a fixed audit calendar. A CDMO that scored low risk at initial qualification can look very different after a change in ownership or a string of deviations that never triggered a full reassessment.
A CDMO’s quality agreement is only as reliable as the inspection history behind it on the day you renew, not the day you signed.
What a Real Contract Risk Review Should Include
Renewing a CDMO agreement deserves the same scrutiny as qualifying a new one. Three shifts make that possible:
Continuous compliance monitoring, not a renewal-cycle checklist. Warning letters, Form 483 observations, and inspection outcomes at a CDMO should feed into a sponsor’s risk view as they happen, not get discovered during the next scheduled audit.
Visibility into the CDMO’s own supplier base. A contract manufacturer’s quality agreement covers its direct obligations to the sponsor, but component and raw material risk one or two tiers upstream of the CDMO rarely gets the same scrutiny, even though 21 CFR 211.84 violations trace directly back to incoming material testing.
Dollar exposure attached to specific clauses. Batch release timelines, exclusivity terms, and minimum volume commitments each carry different financial exposure if a CDMO’s compliance standing deteriorates. Quantifying that exposure in working capital at risk gives quality, procurement, and finance teams a shared number instead of a pass/fail audit score.
This is the problem Chain Verity (chainverity.ai) was built to solve, with real-time monitoring across tier 1, 2, and 3 suppliers and dollar-denominated risk exposure in place of static compliance checklists. Pharma teams evaluating how continuous risk monitoring would apply to their own CDMO network can look at early access through the design partner program.
Frequently Asked Questions
Q: What quality risks should pharma companies check before renewing a CDMO contract?
A: Sponsors should review recent FDA inspection history, any warning letters or Form 483 observations, and whether the quality agreement still reflects the CDMO’s actual production process. A renewal based on a multi-year-old risk profile ignores everything that has changed since.
Q: Why does FDA hold sponsors responsible for CDMO quality failures?
A: FDA has stated in recent warning letters that it regards contract manufacturers as extensions of the sponsor company. The obligation to ensure GMP compliance doesn’t transfer away simply because production happens at a third-party facility.
Q: What is ICH Q9(R1) and why does it matter for contract manufacturing?
A: ICH Q9(R1) is the international guideline on quality risk management, adopted by FDA and the European Medicines Agency. It directs sponsors to scale oversight to actual risk level rather than a fixed audit schedule, which bears directly on how often a CDMO relationship should be reassessed.
Q: How common are GMP violations at contract manufacturing facilities?
A: Contract manufacturing facilities account for roughly 40% of the warning letters FDA issues for GMP violations, and volume rose sharply in FY2025. Component identity testing failures under 21 CFR 211.84(d)(1) were cited in more than half of CGMP warning letters issued to pharma manufacturers that year.
