Technical Assessment of a CDMO Before You Sign

Picking a CDMO usually happens under two pressures at once: a schedule that was set before diligence started, and a sales process that is very good at answering the questions you ask and quiet about the ones you don’t. A quality audit checks whether the site’s quality system meets GMP expectations. It is necessary and it is not sufficient, because a CDMO can pass a quality audit cleanly and still be the wrong technical fit for a specific process, at a specific scale, on a specific timeline. The technical assessment goes further, answering a narrower and more concrete question: can this facility, this equipment train, and these people actually run your process and hit your specifications. This article walks through how to run that assessment and how to turn what it finds into a technical agreement that holds up.

In-House, CDMO, or Hybrid: The Decision Before the Assessment Starts

A technical assessment answers whether a specific CDMO can run a specific process. It assumes the decision to outsource has already been made, and that assumption is worth checking before the first request for information goes out, because the three paths, build the capability in-house, outsource it entirely, or split the process across a hybrid model, carry different risk profiles that a CDMO-focused assessment alone will not surface.

In-house build gives a sponsor direct control over scheduling, data access, and process knowledge, at the cost of capital investment, a longer timeline to first GMP batch, and the burden of building and maintaining a quality system a CDMO already has running. It tends to make sense for a platform technology the sponsor expects to run across multiple programs, where the fixed cost amortizes, or for a step close enough to the product’s core intellectual property that the sponsor is unwilling to disclose it outside the organization.

Full outsourcing shifts capital cost and quality system burden to the CDMO, at the cost of the capability, capacity, and culture risk this article spends most of its length on, plus a real loss of day-to-day visibility into the process unless person-in-plant oversight fills that gap. It tends to make sense for a sponsor without an existing manufacturing organization, for a unit operation the CDMO runs far more often than the sponsor ever would, or for a program where speed to first-in-human material matters more than long-run cost per batch.

A hybrid split, drug substance at a CDMO and drug product fill-finish in-house, or the reverse, or an early-phase CDMO campaign with a plan to insource at commercial scale, concentrates the technical assessment on fewer unit operations but adds an interface risk the all-CDMO or all-in-house paths do not carry: a tech transfer and a quality agreement boundary sits in the middle of the process rather than at its edges, and that boundary is exactly where a characterization gap or a data-ownership question tends to surface late. See the tech transfer document spine for what has to be in place at that internal boundary, whether the two sides of it are two CDMOs, two of the sponsor’s own sites, or a CDMO and an in-house suite.

None of these questions has a universal answer, and a sponsor under schedule pressure is prone to answering all four in whatever direction gets a contract signed fastest. The decision deserves the same evidence-based habit the rest of this article applies to a specific CDMO: write down the answer to each question and the reasoning behind it, so a reviewer two years later, an inspector or a new team member, can see why the program chose the path it chose rather than inferring it was never actually decided.

Capability, Capacity, and Culture Are Three Different Questions

Selection processes routinely conflate three things that need to be assessed separately.

Capability asks whether the CDMO has actually run this modality, this unit operation, and this scale successfully before, not whether the sales deck lists a suite that could theoretically do it. A site that has run a dozen monoclonal antibody campaigns is not automatically capable of running a lentiviral vector process, even in an adjacent suite with similar-looking equipment.

Capacity asks whether the CDMO has an actual open slot, trained headcount, and equipment availability that lines up with your timeline, not theoretical capacity on paper. This is the axis CDMOs are least forthcoming about under signing pressure, because the honest answer is sometimes “not for another eight months,” and that answer does not close deals. A site can be fully capable and still be the wrong choice right now because it is fully booked.

Culture asks whether the organization will tell you bad news early, escalate a deviation honestly and promptly, and push back on an unrealistic ask, or whether it will agree to everything in the room and then quietly slip the schedule. Culture is the hardest of the three to assess and probably the most predictive of how the relationship actually goes over several years. You get at it by watching how technical staff, not just business development, handle a hard question they don’t have a scripted answer for, and by talking to a reference the CDMO did not choose for you, ideally about a program that had a real problem and how the site handled it, not just the reference willing to say everything went smoothly.

The common mistake is treating capability as a proxy for the other two: “they clearly know how to do this, so it will be fine.” The actual risk is usually a fully booked facility and a program manager stretched across six other sponsors, and that risk is invisible if capability is the only thing you checked.

Capacity Reservation and Slot Contract Terms

Confirming that a CDMO has real, open capacity today answers only today’s question. The risk that actually bites a program is usually not whether capacity exists but whether the specific calendar window booked for your batch will still be yours when the date arrives, nine or twelve months out, after the sales conversation has long since moved on to the next prospect. That is a contract-mechanics question, not a technical-fit question, and it lives in the master services agreement and the statement of work, not in the capability deck or the facility tour.

A CDMO’s manufacturing suites, fill lines, and trained operators are a finite, shared resource allocated across every sponsor it serves. When two programs’ schedules collide, whoever holds the stronger contractual claim to that specific window keeps it, and a program that never asked what its own claim actually says in writing finds out the hard way which side of that collision it landed on.

Four terms are worth naming specifically before signature, not after a slot gets bumped: whether the booked date is a firm, binding commitment with a defined remedy for a missed date, or a non-binding planning estimate dressed up as a date; whether a reservation or capacity-holding fee, if one is charged, actually buys priority over a sponsor who did not pay one; what happens if the sponsor’s own readiness slips, tech transfer, comparability, or material release running late, does the CDMO hold the date, rebook to the next opening, or treat the slot as forfeited with no credit; and what happens if the CDMO needs the same window for an unrelated reason, another sponsor’s emergency batch, an equipment failure elsewhere in the facility, is there a defined make-good commitment or no remedy beyond an apology.

Ask the CDMO’s contracts contact directly which of these the current master services agreement or statement of work actually addresses, and read the clause yourself rather than accepting a sales contact’s paraphrase. A CDMO’s forfeiture and bump language is frequently stricter for a scarce, commercial-scale GMP manufacturing slot than for an earlier, more flexible development or engineering-run slot, so confirm which type of slot the language in front of you actually governs.

A worked illustration: Acme Therapeutics booked a commercial-scale process performance qualification slot nine months out at a fill-finish CDMO. The statement of work described the date as a target, with no defined remedy for a miss on either side and no make-good language for a CDMO-side bump. Two months before Acme’s date, a larger sponsor’s emergency batch needed the same fill line; the CDMO moved Acme’s slot to the next opening, four months later, with no fee credit, because nothing in the contract obligated anything beyond that. The lesson a later technical assessment applied directly: read the slot-reservation language before signature, and insist on a named remedy, a guaranteed next-available window or a fee credit, rather than accepting a target date standing alone.

Once a slot is actually booked and the contract terms are settled, the ongoing readiness tracking against that date is a separate, operational discipline; the CDMO PPQ Slot Readiness Log is built for that phase. This section is about the question that has to be answered before the slot is booked at all: what does the contract actually promise, and is that promise worth anything if the calendar gets contested.

The Technical Assessment Is Not the Quality Audit

A GMP quality audit, run by the quality or audit function, checks the quality system against 21 CFR 211 and the ICH Q10 pharmaceutical quality system framework: procedures exist, deviations are managed, CAPA closes, training is current. The technical assessment is a separate exercise, usually run by technical operations, MSAT, or CMC counterparts, and it should happen before or alongside the quality audit, not afterward on the assumption that a clean quality audit implies technical fit.

Where possible, run them together. A technical finding, the wrong single-use tubing set qualified for the site, for example, can turn into a change-control question that belongs in the quality conversation. A quality finding, weak deviation trending, for example, should change how much weight you put on an equipment fit claim you have not independently verified. The two lenses inform each other, and running them as separate, sequential exercises with no shared findings list is how gaps fall through the middle.

How deep to go on each section below is itself a decision, and ICH Q9(R1)‘s formality principle, that the rigor and documentation applied to a risk-based assessment should scale with the risk rather than apply uniformly, is the right basis for making it. A first-in-class modality, or a sole-source process feeding a single patient population, earns the full technical assessment across every section that follows. A well-characterized small molecule moving to a CDMO with a long, verifiable track record on that exact unit operation can reasonably run a lighter version of the same assessment, provided the decision to go lighter is itself documented, not just assumed because the schedule is tight.

Equipment Fit

The single-use versus stainless steel decision is not a preference; it is a set of concrete factors. Campaign length and changeover frequency matter, since single-use systems tend to favor fast turnaround between different clients’ campaigns at a multi-product site. Extractables and leachables qualification history matters at the level of the specific film, tubing, and connector set actually in use, not “single-use is qualified” as a category claim. The scale ceiling of single-use technology at the volumes the process needs matters, since some single-use formats simply stop being practical past a certain scale.

Scale fit deserves a direct, skeptical look: does the CDMO’s actual equipment train match the scale your process was developed and characterized on, or is the answer “we can make it work” on a train that is meaningfully bigger or smaller. A process characterized at one scale carries real risk when it moves onto equipment with a different mixing profile, geometry, or fill-line speed. This is effectively the same equipment gap assessment that belongs in the tech transfer document spine, just performed earlier, before a contract locks in the site.

Where a scaled-down model enters the conversation, ask which stage the CDMO intends to use it for. FDA’s August 2026 CGT FAQ guidance (docket FDA-2024-D-4311, discussed further below) is direct on this point: scaled-down models are a legitimate way to evaluate process variability, set process parameters, and run supportive studies such as viral or impurity clearance at the design and characterization stages, but process performance qualification itself has to be supported by data from commercial-scale batches, not a scaled-down proxy. A CDMO that proposes running PPQ on anything short of the intended commercial scale, or that cannot clearly explain why its scaled-down characterization work represents the commercial process closely enough to justify skipping a bridging study, is describing a gap the assessment needs to catch before it becomes a filing problem.

A real gap assessment row names the factor, the sponsor’s characterized state, the CDMO’s actual state, and a disposition someone can act on, not a checkbox:

The pattern each row has to force is the same: a difference by itself is neutral, and the disposition is what turns it into either an accepted risk or a condition on the contract.

For a shared, multi-product train, ask directly what the cleaning validation basis is between campaigns rather than accepting a general assurance that cleaning is validated. General cleaning validation principles under ICH Q7 apply to drug substance operations, but the specific basis for your product’s cross-contamination risk on that specific train is a site-specific answer, and for products with elevated cross-contamination sensitivity it is worth asking before price comes up. For sterile fill-finish specifically, weigh the site’s contamination control strategy against the expectations in EU GMP Annex 1 if the product will be sold into the EU market, since that annex’s 2022 revision raised the bar on several points that older facilities may not yet have caught up to.

Suite Classification and Single-Use vs. Stainless: A Worked Comparison

The Equipment Fit discussion above treats single-use versus stainless as a set of factors to weigh. It is worth laying the comparison out side by side, because a sales conversation tends to present single-use as a default modern choice and stainless as legacy, and that framing skips the factors that actually decide which one fits a specific process.

Neither column is the right answer in general; the right answer is specific to the process’s campaign length, scale, and supply chain tolerance, and a CDMO that recommends one over the other without naming which of these factors drove the recommendation is substituting a default for an assessment.

Suite classification deserves the same specific treatment. ISO 14644-1 defines air cleanliness classification by particle concentration across nine ISO classes, and EU GMP Annex 1 maps its own Grade A through D sterile manufacturing grades to what an operation actually is, an open aseptic connection, a background environment for a closed system, and so on, rather than to a single blanket classification for an entire suite. Ask the CDMO to state, step by step through the actual unit operations your process needs, which grade or ISO class applies to each step, not a single classification claimed for the whole suite. A site that classifies an entire multi-room suite as one grade, when the process actually needs an open aseptic connection in only one room and a lower grade suffices elsewhere, is either overstating its own facility or has not mapped its own classification scheme to the process steps it runs, and either answer is worth a follow-up question before the contract is signed.

Currency: The EU GMP Part IV Revision for ATMP CDMOs

Anyone assessing a CDMO that runs sterile advanced-therapy manufacturing for the EU market should know that EU GMP Guide Part IV, the chapter specific to advanced therapy medicinal products, is itself under revision. EMA published a concept paper on the revision on May 8, 2025, with public consultation closing July 8, 2025; a draft guideline is provisionally targeted for release in September 2026, with full adoption expected around March 2027. The stated aim is to bring Part IV, largely unchanged since November 2017, in line with the contamination control strategy and quality risk management concepts that the 2022 revision of Annex 1 already applies to sterile products generally, and to address manufacturing approaches the current text does not cover well: closed single-use systems, automated and robotic processing, and rapid microbiological testing methods.

None of that is final yet, and a technical assessment should not treat a draft as binding. What it should do is ask a sterile-ATMP CDMO how its contamination control strategy and quality risk management documentation already track the Annex 1 model, since that is the direction Part IV is moving, and a site that has not started that work has real catch-up ahead of it, catch-up that can land during your program’s tech transfer or PPQ window if the timing runs unlucky.

Critical Starting Material and Raw Material Sourcing Risk

A technical assessment that stops at equipment and analytical readiness misses a failure point that sits earlier in the process than anything on the equipment train: whether the CDMO can actually source, qualify, and consistently supply the specific starting materials the process depends on. For advanced-therapy modalities the starting materials themselves carry a level of biological and supply risk that a small-molecule raw-material qualification file rarely has to address.

Ask what the CDMO’s plasmid DNA supply chain looks like, not just whether it has one. A viral vector process depends on plasmid manufactured to a defined grade, research-grade, GMP-like, or full GMP, at a defined scale, and the plasmid manufacturer, whether the CDMO’s own facility or a separate supplier, is itself a sub-tier vendor whose qualification the CDMO has to own. USP has a general chapter in development, <1040>, Quality Considerations of Plasmid DNA as a Starting Material for Cell and Gene Therapies, first published for public comment in November 2023; a CDMO whose plasmid qualification practice already tracks the quality considerations that chapter describes, sequence confirmation, topology, purity, and endotoxin control specific to plasmid as a starting material rather than borrowed wholesale from a generic raw-material specification, is ahead of where the standard is heading, and one that has not started that conversation has a gap worth naming now rather than during a filing.

The same question applies to viral seed stock, master and working cell banks, and any critical raw material with a narrow, hard-to-replace supplier base: cytokines, growth factors, and specialized media components used in cell expansion. ICH Q5D, Derivation and Characterisation of Cell Substrates Used for Production of Biotechnological/Biological Products, sets the general expectation for how a cell substrate’s history, characterization, and banking are documented and controlled; ask whether the CDMO’s own cell banking practice, or the sponsor’s bank if the sponsor supplies it, was built to that standard, and who holds the master file. A single point of failure in any of these materials, one qualified lot of viral seed stock with no confirmed backup, one cytokine sourced from a single vendor with a known allocation history, is a supply risk the technical assessment should surface before it becomes a manufacturing schedule risk.

A strong answer to “what would you check beyond the equipment train” names starting-material sourcing explicitly and separates it from general raw-material qualification, because the failure mode, a single point of biological failure with a multi-month replacement timeline, is different in kind from a generic reagent stockout.

Assessing a CDMO’s Own Supply Chain: Fourth-Party Risk

The starting-material sourcing risk above covers the biological materials a process depends on directly. A separate and frequently unexamined layer sits underneath it: the CDMO’s own suppliers for the single-use systems, filters, resins, calibration services, and outsourced testing the CDMO relies on to run your process at all. A sponsor qualifies the CDMO as a third party. The CDMO’s own suppliers are, from the sponsor’s seat, fourth parties, and a technical assessment that stops at the CDMO’s front door never asks whether that fourth-party layer is itself qualified and resilient.

ICH Q7’s materials management expectations, written for active pharmaceutical ingredient manufacturing but a reasonable reference point here, include a specific traceability principle worth asking a CDMO about directly: where the CDMO’s own supplier of a critical material is not itself the manufacturer of that material, the CDMO should know, and be able to tell you, who the actual manufacturer is. A CDMO that sources a filter assembly or a cell processing bag through a distributor and cannot name the actual film or resin manufacturer behind it has a traceability gap that becomes your gap the moment that distributor substitutes a different source without telling anyone, since the distributor’s own change notification practice is not something your quality agreement with the CDMO reaches.

Ask about four categories specifically, since each fails differently:

• Single-use system and critical consumable manufacturers: bags, tubing, filter assemblies, chromatography resins. Ask whether the CDMO’s qualification file names the actual manufacturer and resin or film lot family, not just a part number, and whether the CDMO is notified of a manufacturer-level change before it reaches your batch, consistent with the component testing and approval expectations under 21 CFR 211.84, which already require every component used in manufacturing to be tested and approved against its own specification before use.
• Outsourced analytical and calibration services: a CDMO that sends a specific assay, a potency method, a sterility test, or instrument calibration to a sub-tier laboratory is extending your analytical transfer risk one layer further than the transfer plan discussed earlier usually accounts for. Ask which methods, if any, are run outside the CDMO’s own walls, and ask for that sub-tier lab’s own regulatory standing the same way the next section asks for the CDMO’s.
• Critical equipment service and spare-parts providers: a single-source service contract on a bioreactor controller or a lyophilizer, with no documented alternate service path, is a capacity risk hiding inside an equipment fit claim that otherwise looks fine on paper.
• Raw material distributors versus manufacturers: a distributor relationship for any raw material the process treats as critical should come with the CDMO’s confirmation that it has visibility to the actual manufacturing site and lot genealogy, not just a distributor’s own certificate of analysis.

A fourth-party gap rarely shows up in a facility tour, because the tour shows the CDMO’s own suite, not its suppliers’ operations, and it rarely shows up in a standard raw-material qualification file either, because that file is built around the CDMO’s immediate supplier relationship, not the layer behind it. See the paired CDMO Fourth-Party and Sub-Tier Supplier Risk Assessment for a structured way to name these dependencies and score them before they become a mid-campaign surprise. Filter and resin extractables qualification pedigree specifically is worth tracing all the way to the actual manufacturer for any sterilizing-grade or chromatography component; see filter validation for biologics and oligonucleotides for how that qualification chain should read once a specific filter is in scope.

Biosafety, Containment, and GMO Handling Fit for Viral Vector CDMOs

A facility that runs viral vector or other genetically modified organism-based processes needs a containment and segregation posture that a technical assessment focused only on process and cleaning validation can miss entirely. Confirm the CDMO’s biosafety classification for the specific vector platform in scope, a replication-incompetent AAV vector and a lentiviral vector do not carry the same containment expectation, and ask whether the site’s institutional biosafety committee, or equivalent internal biosafety governance, has reviewed the specific process at the scale intended, not just the modality in general. Many viral-vector CDMOs align internal containment practice with the NIH Guidelines for Research Involving Recombinant or Synthetic Nucleic Acid Molecules even for GMP-scale commercial manufacturing, since that framework, developed for research use, is frequently the closest available reference for how a specific construct should be contained; a site’s own risk assessment justifying its containment level for the actual commercial-scale process, not a borrowed research-scale determination, is what the technical assessment should ask to see.

For sites manufacturing in the EU, contained use of genetically modified micro-organisms carries its own regulatory layer, separate from GMP, under the EU’s contained-use directive framework; ask whether the site holds the applicable environmental or contained-use authorization for the vector platform and scale in question, since a gap here is a legal operating requirement, not a quality nicety. Segregation from non-GMO manufacturing on a shared, multi-product site deserves the same skeptical treatment given to cleaning validation above: a general assurance that biosafety is handled is not the same as a documented, process-specific containment and waste-inactivation procedure that a reviewer or inspector can trace. See the paired CDMO GMO Containment and Biosafety Risk Assessment for a structured way to capture that determination and its supporting evidence.

Analytical Transfer Readiness

The lab, not the manufacturing suite, is frequently the actual bottleneck. Confirm whether the CDMO’s analytical lab already has the instrumentation your methods require, already qualified under USP General Chapter <1058>, Analytical Instrument Qualification, or whether qualification will sit on the critical path of the transfer timeline, which is a real schedule risk if nobody accounted for it. Ask for a credible analytical method transfer plan aligned to USP General Chapter <1224>, Transfer of Analytical Procedures, including which approach applies for each method, comparative testing, co-validation, or a transfer waiver where scientifically justified.

Reference standards and critical reagents are worth naming explicitly: does the CDMO have, or can it readily obtain and qualify, the reference standards, cell banks, or critical reagents your methods depend on, and who owns sourcing them if not. For biological or potency assays specifically, ask about the lab’s actual experience running assays with real biological variability, not just chromatography. That experience gap, a lab that is excellent at HPLC and has never run a cell-based potency assay at scale, is one of the most common places an analytical transfer stalls out.

Process Validation and PPQ Track Record

A CDMO’s process validation history is a distinct assessment dimension that a facility tour and a capability slide routinely skip past, and it deserves its own line of questioning rather than getting folded into general capability. The questions to ask are concrete: how many process performance qualification campaigns has this site actually run to completion, for this modality or an adjacent one, and how many of those needed a deviation investigation mid-campaign rather than running clean. FDA’s August 2026 CGT FAQ guidance confirms there is no fixed, regulation-mandated PPQ lot count; the number has to be risk-based and sufficient to demonstrate that consecutive runs perform as expected and consistently meet acceptance criteria, the same principle behind the site’s own PPQ batch-count risk-based justification. A CDMO’s technical team should be able to walk through how it has built that justification before, not recite “three batches” as an unexamined default; a site that treats the batch count as fixed rather than risk-derived is signaling it has not internalized the flexibility the current guidance actually offers, which becomes your problem the day a limited-lot program needs that flexibility argued convincingly in a filing.

The same conversation should cover how the site distinguishes characterization testing from release testing in its own analytical practice, since the two carry different acceptance-criteria and CGMP obligations under the same FAQ guidance, and a lab that conflates them in its own method documentation is more likely to conflate them in yours. See PPQ readiness prerequisites for how that batch-count justification and process characterization evidence come together before a PPQ protocol is approved, work that has to happen whether the manufacturing site is the sponsor’s own or a CDMO’s.

Data Systems and Data Integrity Posture

Ask plainly what actually runs the batch record: paper, a hybrid system, or a validated electronic batch record or manufacturing execution system, and how deviations and out-of-specification results get captured and investigated. For any electronic system, ask about audit trail configuration and actual review practice, not just whether an audit trail exists. Missing or unreviewed audit trails remain among the most cited findings in FDA’s 2018 guidance, Data Integrity and Compliance with Drug CGMP, and in MHRA’s GxP data integrity guidance, and the expectation applies exactly as much to a CDMO’s systems as to a sponsor’s own.

Ask how data flows back to you: in real time or on a batch-delayed basis, with access to raw data or only to summarized reports, and whether you will have the access needed to do your own trending or to support a regulatory filing if the data ends up in one. A CDMO that cannot clearly answer who reviews the audit trail and on what schedule is telling you something real about its data integrity maturity, regardless of what the quality audit checklist says. Scoring that answer, and the rest of the site’s record-keeping, against each ALCOA+ element rather than a single pass/fail impression is what gives the assessment a specific, checkable basis; a ready-to-use worksheet for that scoring exercise is at ALCOA+ data integrity risk assessment worksheet.

The consequence of getting this wrong is not hypothetical, and it is not limited to the manufacturing site itself. FDA’s warning letter database lists warning letter 720463, issued to Tentamus India Private Limited, a contract testing laboratory, on March 3, 2026, following an inspection conducted August 14 through 22, 2025, citing current good manufacturing practice violations including a quality unit that failed to investigate discrepancies and out-of-specification results and a failure to document laboratory controls contemporaneously; the letter states FDA may withhold approval of new applications or supplements listing the firm as a contract testing laboratory until the violations are completely addressed, and warns that FDA could refuse admission of articles tested there into the United States. A sponsor that outsources release testing to a lab in that position inherits the consequence even though the lab, not the sponsor, failed the inspection, which is exactly why the analytical and data integrity assessment has to look at any outsourced testing laboratory directly, not accept it on the strength of the CDMO’s own vendor qualification file for that lab.

Regulatory Standing and Inspection History

A CDMO’s own account of its regulatory standing is a starting point, not a verified fact, and checking it independently before the first site visit costs almost nothing next to what a missed finding costs later. FDA’s Inspection Classification Database, searchable at the agency’s public site by firm name, project area, inspection end date, and classification, and mirrored in a weekly Data Dashboard update, lists the final classification, No Action Indicated (NAI), Voluntary Action Indicated (VAI), or Official Action Indicated (OAI), for each inspected project area. Two practical traps sit inside that search. A firm’s name in FDA’s records is not always standardized, a site that changed names, was acquired, or operates under a parent-company variant may need several search attempts before its history turns up, and the dataset is project-area specific rather than firm-wide, so the same inspection visit can show NAI for one area of the facility and VAI or OAI for another; a clean overall impression from a single classification pulled out of context is not the same as confirming the specific unit operation or product type relevant to your program came back clean. For a site manufacturing into the EU, EudraGMDP, the EMA’s public database of manufacturing and import authorizations, GMP certificates, and statements of non-compliance, is the equivalent independent check, worth running regardless of which regulator the CDMO names as its primary inspecting authority, since a site can hold standing with more than one.

A classification alone does not answer the question that matters, which is whether whatever drove it touches your process, your product type, or your quality systems reliance on the site. Treat a finding here the same way the rest of this assessment treats any other finding: name it, assess whether it is scope-critical, and route it to Regulatory/CMC and Quality Assurance for a documented risk position before the program proceeds, rather than letting an independent check happen informally or not at all.

See the paired CDMO Regulatory Standing and Inspection History Check for a repeatable version of this search.

CDMO Financial Health and Business Continuity Risk

Independently checking a CDMO’s regulatory standing, as the section above describes, answers whether the site has run into trouble with an inspector. It says nothing about whether the business running the site will still be running it at all by the time your program needs it to. A site can score strong on every technical and quality dimension in this assessment and still close, get sold, or get reclassified internally as a non-core asset mid-program, for reasons that have nothing to do with its equipment, its quality system, or its inspection history, and a technical assessment that never asks the question is simply blind to that failure mode until it happens.

This is not a hypothetical category for advanced-therapy programs specifically. Cell and gene therapy manufacturing investment fell sharply between 2021 and 2024, and the resulting overcapacity has driven a real, publicly documented wave of site closures, capacity rationalization, and at least one outright CDMO bankruptcy across the sector during that period, alongside several large contract manufacturers announcing a strategic exit from cell and gene therapy manufacturing entirely. None of that shows up in a facility tour or a capability slide, and a sales contact mid-pitch is the last person likely to volunteer it.

What to check, specifically: for a publicly traded CDMO or a publicly traded parent, a going-concern note or qualified audit opinion in the most recent 10-K or 10-Q is the clearest formal warning signal available, and segment-level revenue and margin trend for the CDMO business over the prior four to eight quarters shows whether that specific business line is shrinking or losing money even when headline corporate results look stable. For a privately held or financial-sponsor-owned site, that disclosure does not exist, so the check becomes a direct question: what is the ownership structure, how long has the current owner held this asset, and is there a known exit timeline, since a financial sponsor nearing the end of a typical hold period carries its own exit incentive that may not run on the same clock as a multi-year manufacturing program. Trade press covering contract development and manufacturing is worth searching specifically for the named site, not just the parent brand, since a site-specific closure or restructuring announcement often surfaces there well before it reaches a sponsor through any other channel. And a direct question worth asking, even though the program manager assigned to your account is rarely the person who can answer it: is this specific site or business unit classified internally as a growth, maintain, or divest asset. Escalating that question past the program manager to a site or business-unit leader, and noting whether the question gets a straight answer at all, is itself useful information.

A continuity risk here is not purely commercial. For certain drug and biological products, Section 506C of the Federal Food, Drug, and Cosmetic Act requires the application holder to notify FDA of a permanent discontinuance, or an interruption likely to cause a meaningful supply disruption, in manufacturing, generally at least six months ahead of time or, where that is not possible, as soon as practicable and no later than five business days after the interruption occurs. Section 506C(j), added by the CARES Act in March 2020, goes further for manufacturers of drugs that are life-supporting, life-sustaining, intended to treat a debilitating disease or condition, or that would be considered critical in a public health emergency, a category that reaches many advanced-therapy products: it requires a redundancy risk management plan evaluating supply risk at each manufacturing establishment. FDA’s draft guidance on building that plan, Risk Management Plans to Mitigate the Potential for Drug Shortages, was published May 19, 2022, with its comment period closing July 19, 2022, and remained in draft as of this writing. A sponsor cannot build a credible redundancy risk management plan for an establishment whose own business continuity it has never actually assessed, which is exactly the gap this section exists to close.

Treat a finding here the same way the rest of this assessment treats any other finding: name it, decide whether the program’s exposure is proportionate to what was actually found, and document the decision, a mitigation such as a warm second source, or an accepted risk, rather than letting it stay an informal worry nobody wrote down. See the paired CDMO Financial Health and Business Continuity Risk Assessment for a structured way to run this check and score what it finds.

Multi-Site Networks: The Same CDMO Is Not the Same Site Twice

A technical assessment run against a CDMO’s corporate capability deck, rather than against the specific site your batches will actually run in, is assessing the wrong thing whenever that CDMO operates more than one site. Capability, capacity, culture, equipment fit, and regulatory standing are all properties of a site, not of a company name, and a network sales conversation tends to blur that distinction in the sponsor’s favor during the pitch and against the sponsor’s favor once the contract allocates a specific site to specific batches.

The regulatory standing check described above is the clearest place this shows up concretely: FDA’s Inspection Classification Database scores a project area at a specific physical site, and a clean inspection history at one site of a multi-site network says nothing about a second site’s history, even under the same corporate quality system and the same executive leadership. Run the independent inspection-history check, and for EU-market product the EudraGMDP check, against the exact site named in the proposed scope of work, not against the CDMO’s name as a whole, and re-run it if the proposed site changes at any point before signature.

The same logic applies to equipment fit and capacity. A CDMO proposing “network capacity” across two sites as if it were one undifferentiated pool is a specific pattern worth a direct question: which site runs the equipment train your process actually needs, is that the site with the open capacity being offered, and if the two sites differ, has the equivalency between them been established with the same rigor a tech transfer between two unrelated companies would require. A same-company transfer between a CDMO’s own sites still moves a process across a real equipment, utility, and personnel boundary, and the gap-assessment habit described earlier applies to that boundary exactly as it applies to a first qualification. For a sterile product moving between two sites, confirm whether the receiving site’s own Qualified Person certification and batch release process under EU GMP Annex 16 treats the two sites as equivalent for release purposes, or whether release authority itself differs by site.

Two further practical implications are easy to miss. First, Validation Master Plan scope needs to be allocated explicitly by site, not assumed to follow the corporate relationship; the paired Sponsor-CDMO VMP Scope Boundary Matrix extends directly to a multi-site scenario by adding the site as a dimension of the matrix, and validation master planning covers the underlying principle of why that allocation has to be explicit rather than inferred. Second, continued process verification trending has to run per site; pooling Stage 3 monitoring data across two physically different trains can average away a drift that is real and specific to one site, the opposite of what continued process verification is supposed to catch. If a program’s batches are split, or later migrated, between two sites of the same network, both of these need a deliberate, documented decision, not a default inherited from whichever sales conversation introduced the second site.

Once a relationship is live across more than one site, the ongoing tracking burden shifts from the technical assessment to change control and deviation management; the paired Network Change Control Master Record and Network Process-Step Duplication Map carry that forward, but neither replaces the site-specific technical assessment that should happen before a second site is added to a program’s scope in the first place.

Exit Strategy, Dual-Sourcing, and IP and Data Ownership at Termination

Everything above answers whether this CDMO can run your process today and whether it is likely to still be standing to run it next year. A technical assessment that stops there never asks the mirror question: if the relationship ends, on short notice, for cause, or because the business-continuity risk described earlier actually materializes, can the program actually leave with what it needs to keep running somewhere else. That question is answered entirely by what gets negotiated into the contract before signature, not by anything discovered once the relationship is already underway and the stronger negotiating position has shifted to whichever side needs the exit less.

Three things to pin down before signing, not after. Tech transfer package completeness at exit: does the contract obligate the CDMO to deliver a complete, usable tech transfer package, batch records, deviation history, analytical method files, raw material specifications, and equipment parameter sets, on a defined timeline following termination, or does it leave the commitment as undefined “reasonable assistance,” a phrase that means whatever the CDMO’s post-termination bandwidth happens to allow. Ask for an example of how long a prior client’s transition actually took in practice, not just what the contract promises on paper. Data and intellectual property ownership: who owns the process data generated while the CDMO runs your process, who owns any process improvement the CDMO’s own staff develops while running it, and does the sponsor’s right to that data and any improvement survive termination regardless of why the relationship ended, for convenience, for cause, or because the CDMO itself became insolvent. Ambiguous language here tends to surface only when it is tested, exactly when the relationship is already strained and neither side wants to be generous. Dual-sourcing and second-source readiness: is there a second CDMO, or an in-house fallback, already qualified for this step and kept genuinely warm through periodic engineering runs and retained reference standards, or is “we could always find another CDMO” a theoretical option that would actually take a full tech transfer timeline, a year or more for most advanced-therapy unit operations, to activate from a cold start. A termination notice period inherited from a standard contract template, ninety to one hundred eighty days is typical, rarely matches how long a real transfer for this specific modality takes; a notice period shorter than the realistic transfer timeline is not protection, it is a number copied from a template that was never checked against the process it now governs.

The record-retention regulation underneath all of this is worth naming directly. 21 CFR 211.180 requires that production, control, and distribution records specific to a batch be retained for at least one year past the batch’s expiration date, and that those records stay readily available for inspection at the establishment where the described activities occurred. That last clause is exactly the problem a CDMO closure creates: if the establishment itself stops existing, the regulation’s assumption that records live there and stay reachable there breaks, and only a contract clause negotiated in advance, not the regulation itself, can say what happens to that access.

A worked illustration, continuing the Acme Therapeutics scenario from the business-continuity discussion earlier: once the parent company’s quarterly disclosure flagged two of its six sites, not the one running Acme’s program, under a strategic-alternatives review, Acme did not treat its own site as safe by default. It negotiated an explicit tech-transfer-package delivery clause into the master services agreement, a named content list and a sixty-day delivery timeline following any termination for any reason, and it funded a low-volume engineering run at a smaller regional CDMO every eighteen months specifically to keep a second source genuinely qualified rather than qualified only on paper. The incremental cost was real; so was the difference between a one-year transfer and a six-month one the one time it actually mattered.

See the paired CDMO Exit Readiness, Dual-Sourcing, and IP and Data Ownership Assessment for a structured version of this check, and the CDMO-to-CDMO Transfer and Handoff Checklist for the operational execution once an actual transfer is underway; this section is about deciding and contracting for the exit path before it is ever needed, not about running the transfer itself.

Roles and Responsibilities Across the Assessment

A technical assessment run by one person, however capable, misses things a cross-functional team catches, and it is worth naming who owns which piece before the first call with the CDMO.

The common failure mode is letting business development answer questions that belong to technical operations or quality, because the sales conversation is already moving and adding people feels like it slows things down. It slows down the wrong part of the process; a scope call taking an extra week is cheaper than a technical gap discovered after the contract is signed.

Site Visit Logistics: What a Facility Tour Alone Cannot Tell You

A site visit is where a technical assessment either becomes real evidence or turns into a guided tour that confirms whatever the sales deck already claimed. The difference comes down to logistics decided before the visit, not improvisation during it.

Decide who attends before scheduling the date. A visit staffed only by business development and a single technical generalist on the sponsor’s side gets a tour; a visit that brings the actual process SME, the analytical representative, and someone from quality gets a working session, because each of them asks a different kind of question the others would not think to ask. Request, in writing and in advance, which specific operations will be running or demonstrable during the visit window, not just which rooms will be open; a suite sitting idle during the visit tells you nothing about how it behaves mid-campaign.

What a facility tour alone can confirm: that the equipment physically exists, that the suite’s general condition and housekeeping match what a trained eye expects, and that staff on the floor can answer a direct question about the process step in front of them without visibly reaching for a script. What a tour alone cannot confirm, and what has to come from a specific document request layered on top of the visit: actual historical batch performance and deviation rate for that equipment train, not the single clean run staged for the visit; the facility’s real current utilization against the capacity claim, which a tour of an uncrowded suite on a quiet day will not reveal either way; and the specific lot-level qualification behind any single-use assembly or raw material visible on the floor, which requires a document, not a glance at a labeled bag.

A practical test worth applying in the room: ask to see the deviation log for the specific suite or equipment train under discussion, not a summary, and watch how the request is received. A site confident in its own record pulls it up or commits to sending it promptly. A site that redirects to an aggregate metric or defers the request indefinitely is telling you something about its own posture toward the record, independent of what the record itself eventually shows.

Virtual assessments, increasingly common as an early capability screen before committing to travel, can cover the document review and most of the technical question-and-answer session, but they cannot replace an in-person visit for culture signals that depend on body language and unscripted hallway conversation, or for confirming physical conditions, housekeeping, traffic patterns, and visible wear on equipment; a video call is framed by whoever is holding the camera, and it shows only what the host chooses to point it at. Treat a virtual-only assessment as sufficient for an early screen among several candidate sites, and plan an in-person visit before any site reaches a final selection decision for a program of real consequence.

The Assessment Sequence, Start to Signature

The sections above cover what to assess. The sequence below is the order that keeps a cross-functional team from working from different information at different times.

Skipping straight from a facility tour to a technical agreement, without a documented scorecard, findings register, and summary report in between, is how a real gap ends up undocumented anywhere a future audit or a new team member could find it.

The Technical Assessment Summary Report

The scorecard scores each dimension. The disposition register tracks each finding to closure. Neither one is the document an executive sponsor, a regulatory lead, or a new team member joining the program eighteen months later actually wants to read first, because neither is written to be read start to finish; both are structured for lookup, not narrative. The summary report is the third document, and the gap it fills is real: without it, the decision record is a spreadsheet and a set of scores with no connected story explaining why the recommendation came out the way it did.

A summary report earns its place by doing three things a scorecard and a register cannot. It states the recommendation in plain language up front, not buried after several pages of evidence. It explains the reasoning behind any non-obvious call, why a strong weighted score still carries a condition, or why a single red flag outweighed an otherwise clean assessment, in a way a reader outside the assessment team can follow without re-deriving it from the underlying tables. And it becomes the one document a future diligence exercise, an acquirer’s own technical diligence team, for instance, can be handed as the record of why this CDMO was selected, instead of reconstructing the story from a folder of disconnected working files.

The report should be short enough that the executive sponsor reads the whole thing, typically two to four pages for a single-site assessment: a one-paragraph recommendation, a short summary of scope and assessment approach, the two or three findings that actually drove the recommendation, not all of them, the register already holds all of them, and an explicit statement of what happens next, contract negotiation, a bridging study, a second site visit. A report that restates every row of the scorecard and the register in prose is not a summary; it is a second copy of the same data in a harder-to-scan format, and it defeats the purpose it exists to serve.

See the paired CDMO Technical Assessment Summary Report for a structured version of this document, built to sit between the disposition register and the technical agreement exactly where the flow diagram above places it.

Red Flags

The deviation and CAPA trending red flag above deserves its own note: aggregate-only reporting during diligence is frequently the same aggregate-only reporting the relationship will live with afterward, unless the technical agreement fixes it explicitly. See deviations and change control across a CDMO network for what that trending discipline needs to look like once the relationship is live, not just during the assessment that preceded it.

Common Findings in CDMO Diligence Itself

Most of what goes wrong traces back to how the assessment was run, not to something the CDMO hid well.

• No documented technical assessment exists at all; the selection record is a slide deck and a set of emails, which gives an inspector or a future team member nothing to audit against.
• The assessment ran, but every finding lives in a narrative report with no disposition, owner, or date, so open items quietly become permanent.
• Reference calls were arranged entirely by the CDMO, and nobody asked to speak with a client independently.
• The technical assessment and the quality audit ran as two disconnected exercises with no shared findings list, so a technical gap that was actually a quality risk, or the reverse, fell through the middle.
• Capacity was confirmed once, months before signing, and never reconfirmed against the CDMO’s actual booked schedule at the point the contract is executed.
• A red flag was noted in the assessment record but never routed to Quality Assurance for a documented risk acceptance before the program proceeded.
• Starting-material sourcing, plasmid, viral seed stock, cell banks, is treated as a manufacturing detail the CDMO owns entirely, with no sponsor visibility into second-source status until a shortfall actually happens.
• Inspection history was taken on the CDMO’s word alone; nobody ran an independent check against FDA’s Inspection Classification Database or, for an EU site, EudraGMDP, before the assessment closed.
• Capacity was reserved informally through a sales relationship, with no binding date, fee, or make-good language in the actual contract, so a “confirmed slot” turned out to mean nothing once another sponsor’s program collided with it.
• Nobody checked the CDMO’s or its parent’s public financial disclosures or recent trade-press coverage before the assessment closed, even though the site’s technical and quality scores say nothing about whether the business behind it is stable.
• Dual-sourcing was discussed informally during diligence but never actually decided or documented, so the program defaulted to single-source by inertia rather than by a reasoned, risk-based choice.

From Findings to Technical Agreement

The output of the technical assessment should not live only in a slide deck. Every finding needs a disposition: accept as is, accept with a defined interim control, or require remediation before the first GMP batch, and every disposition needs an owner and a target date. That list is exactly what should drive the technical agreement, the operational counterpart to the quality agreement described in FDA’s 2016 guidance, Contract Manufacturing Arrangements for Drugs: Quality Agreements, and reflected in EU GMP Chapter 7 on outsourced activities. The technical agreement should spell out, in terms someone can act on, who is responsible for what across raw material release, in-process control, environmental monitoring, change control, deviation investigation, and data ownership.

Each finding earns its disposition by answering the same three questions in order, not by how inconvenient remediation would be for the schedule:

A worked slice of what that disposition list actually looks like, from an assessment of a fill-finish CDMO for Acme Therapeutics’ ATX-410 lyophilized biologic:

Four different dispositions, one register. The remediation item and the risk acceptance carry equal documentation weight; the difference is which one blocks the first batch and which one doesn’t.

A technical agreement pulled from a template, without being shaped by what the assessment actually found at this specific site, tends to restate generic responsibilities nobody disputes and skip over the specific gap the assessment surfaced, which is exactly the gap most likely to cause a real problem well into the relationship. Track open items from the assessment on the same register used for any other open quality commitment, with closure verified before the first validation batch runs at the new site, not carried forward as a list that quietly becomes permanent.

Interview Q&A

“Walk me through how you would technically assess a CDMO before recommending it.” A strong answer separates capability, capacity, and culture explicitly, distinguishes the technical assessment from the quality audit while noting the two should run together, and describes turning findings into a disposition register with owners and dates rather than a narrative summary. A weak answer describes only the quality audit, or treats a facility tour and a capability slide as sufficient.

“A CDMO looks strong on paper but you have a bad feeling about the relationship. What do you do?” The strong answer treats culture as a real, assessable dimension and points to a specific observable, how technical staff handled a hard question with no scripted answer, or how a reference call went when arranged independently, rather than dismissing the feeling as unquantifiable, and it does not let a strong capability score override a real culture concern.

“How do you decide whether a finding needs remediation before the first batch versus a documented risk acceptance?” The strong answer ties the decision to whether the finding threatens something scope-critical and whether it can be closed with a credible, dated plan, not to how inconvenient remediation would be for the timeline. It states plainly that a scope-critical gap with no closure path is a reason to keep looking, not a reason to accept a compressed schedule.

“What is the difference between the technical assessment and the quality agreement?” The strong answer explains that the technical assessment is the evidence-gathering exercise that produces findings, and the technical agreement, alongside the quality agreement, is where those findings turn into binding, documented responsibility. A weak answer treats the two as the same document, or does not know one precedes the other.

“A CDMO tells you they always run PPQ with three batches, no exceptions. Is that a red flag?” The strong answer says it depends on what is behind the statement. There is no fixed, regulation-mandated PPQ lot count; the number should be risk-based and sufficient to demonstrate consistent performance against acceptance criteria. A CDMO that defaults to three as an unexamined habit, with no risk argument on file for why three is enough for a specific process, has not internalized that flexibility, and that gap becomes a real problem the day a limited-lot program needs a smaller, justified batch count argued convincingly in a filing. A weak answer treats “three batches” as reassuring on its own, without asking what analysis sits underneath it.

“A CDMO’s equipment and quality systems both check out, but you haven’t asked about their plasmid or viral seed stock supplier. Does that matter?” The strong answer says yes, and explains why: a starting-material single point of failure is a different category of risk than a generic raw-material stockout, because re-deriving a seed bank or qualifying a new plasmid supplier can cost months a program schedule does not have, and it can stall the campaign regardless of how strong the equipment train or the quality system is. A weak answer treats starting materials as a procurement detail outside the technical assessment’s scope.

“How would you independently verify a CDMO’s regulatory standing rather than relying on what they tell you?” The strong answer names the actual public sources, FDA’s Inspection Classification Database and Data Dashboard, EudraGMDP for EU sites, describes the OAI, VAI, NAI classification scheme, and flags the practical traps: inconsistent firm naming across records and a classification scored per project area rather than for the whole site. A weak answer treats a facility’s own assurance that it passed its last inspection as sufficient, without describing how that claim would actually be checked.

“How do you decide between building a capability in-house and outsourcing it to a CDMO?” The strong answer names the actual tradeoffs, capital cost and timeline against control and process knowledge, and ties the decision to concrete factors: whether the step is a platform technology run across multiple programs, whether the sponsor has or needs its own quality system for it, and how binding the speed-to-clinic constraint is, rather than defaulting to whichever path is currently fashionable. It also recognizes that a hybrid split creates a real interface risk at the boundary between the two sides. A weak answer treats outsourcing as the default without stating what would have to be true for in-house to be the better call.

“A CDMO proposes running your process at a second site in their network with open capacity. What do you check before agreeing?” The strong answer treats the second site as a new technical assessment, not an extension of the first one: equipment fit, inspection history, and capacity are all site-specific, and a clean record at the first site says nothing about the second. It names the specific things that need independent verification, the second site’s own inspection classification, its own equipment train against the process’s characterized scale, and whether continued process verification trending will run per site or get pooled in a way that could hide a site-specific drift. A weak answer accepts “same company, same quality system” as sufficient justification on its own.

“You find out during diligence that the CDMO sources a critical filter through a distributor and cannot name the actual manufacturer. How serious is that?” The strong answer treats it as a real gap, not a paperwork nicety: without knowing the actual manufacturer and resin or film lot family, the CDMO cannot be notified of a manufacturing-level change before it reaches a batch, and the sponsor has no way to assess a substitution it never hears about. It asks for the CDMO’s traceability basis and, if the gap cannot close quickly, treats it as a finding requiring a disposition like any other, not something to let pass because the CDMO’s own certificate of analysis looks complete. A weak answer accepts a distributor’s certificate of analysis as equivalent to knowing the actual manufacturer.

“The CDMO says you have a reservation for a PPQ slot. What do you actually check before trusting that?” The strong answer goes straight to the contract language, not the sales conversation: whether the booked date is a firm, binding commitment with a named remedy for a miss, or a non-binding planning estimate; whether a reservation fee, if charged, actually buys priority over an unpaid reservation; and what make-good commitment exists if the CDMO bumps the slot for another client’s need. It treats a verbal or email confirmation of a date as worth exactly what it is, an assurance, not a contractual commitment, until the actual clause is read. A weak answer accepts the sales team’s confirmation as equivalent to a binding date and never asks what happens if the date slips on either side.

“How do you build business continuity risk into a technical assessment that otherwise looks only at equipment and quality fit?” The strong answer names concrete, checkable indicators rather than treating financial health as outside the technical assessment’s scope: public parent-company disclosures where they exist, segment-level revenue and margin trend for the CDMO business specifically, ownership structure and hold period for a financial-sponsor-owned site, and trade-press coverage of site-specific restructuring. It also ties the check to a real regulatory stake, a sponsor’s own Section 506C notification and redundancy risk management plan obligations for certain products depend on knowing whether a specific manufacturing establishment can keep running. A weak answer treats financial diligence as entirely procurement’s or legal’s problem, disconnected from the technical assessment.

“A CDMO’s termination clause promises a tech transfer package delivered with ‘reasonable assistance.’ Is that good enough?” The strong answer says no, and explains why: “reasonable assistance” is undefined, meaning it commits the CDMO to whatever bandwidth it has after the relationship has already ended, often with reduced motivation to prioritize a departing client’s request. It asks instead for a named content list, batch records, deviation history, analytical method files, equipment parameter sets, and a specific delivery timeline, and it checks that timeline against how long a real second-source transfer for this specific modality would actually take, not against a generic contract template’s boilerplate notice period. A weak answer accepts “reasonable assistance” because it sounds cooperative, without asking what it actually commits the CDMO to deliver or by when.

The assessment does not end when the contract is signed. Whatever gaps and conditions it surfaces become the day-one agenda for person-in-plant oversight, the ongoing program that watches whether the CDMO the assessment found is the CDMO that actually shows up in year two.

Monday morning, if you are mid-diligence on a CDMO right now: pull the open items from your technical assessment and check how many have a named owner and a date versus how many are just notes in a deck. The ones without an owner and a date are the ones still open when you are trying to release your first commercial batch there.