How to use this document
Copy the template below into your quality system. Replace every <<FILL: ...>> placeholder with your company, system, and process specifics, then route it through your own document control, review, and approval. The filled specimen shows one worked example; adapt the numbers and scope to your operation and verify each cited regulation or standard against the current source before you rely on it.
This is a generic, originally worded starting point. It contains no confidential, proprietary, or employer material, it is drafted with AI assistance and reviewed, it is not legal or compliance advice, and adopting it does not by itself create or prove compliance. See the Disclaimer and Terms.
This is a ready-to-use risk assessment for a question a technical assessment that only looks forward, can this CDMO run my process, never asks: if the relationship ends, on short notice, for cause, or because the CDMO’s own business continuity fails, can the program actually leave with what it needs to keep running somewhere else. That question is answered by what gets negotiated into the contract before signature, not by anything discovered once the relationship is already underway. Replace every <<FILL: ...>> placeholder with your own specifics and route it through your normal document control, review, and approval. A worked filled specimen follows. Verify each cited reference against the current source before you rely on it.
1. Purpose
This assessment evaluates whether the program’s contract with <<FILL: CDMO name>>, and the program’s own dual-sourcing posture, would actually support an orderly exit, a complete tech transfer package, clear data and IP ownership, and a realistic second-source timeline, rather than assuming an exit is possible until one is actually needed.
2. Scope
3. Responsibilities
4. Methodology
Read the actual termination, data-rights, and intellectual property clauses in the master services agreement and technical agreement directly; do not rely on a sales or program-management summary of what the contract says. Score each dimension against whether the commitment is specific, dated, and survives termination for any reason, not against whether it sounds cooperative. Dual-sourcing readiness is scored against whether a second source is actively maintained, not merely theoretically available.
5. Scoring scale
6. Tech transfer package and termination contract terms
7. Data and intellectual property ownership
8. Dual-sourcing and second-source readiness
9. Residual risk acceptance and conclusion
10. References
FDA guidance, “Contract Manufacturing Arrangements for Drugs: Quality Agreements” (November 2016).
EU GMP Guide, Chapter 7, Outsourced Activities.
21 CFR 211.180, General requirements for records retention.
ICH Q10, Pharmaceutical Quality System, management of outsourced activities.
Confirm the current version of each reference before issue.
11. Revision history
12. Approvals
Filled specimen
Extract from an example assessment for Acme Therapeutics’ ATX-520 AAV gene therapy program at a viral-vector CDMO, run after the business-continuity assessment flagged the parent’s segment-level revenue decline. Company and product are illustrative.
Negotiated outcome: Acme amended the master services agreement to add a named content list (batch records, deviation history, analytical method files, raw material specifications, equipment parameter sets) with a sixty-day delivery commitment following termination for any reason, and added explicit language that data and IP rights survive termination for convenience, for cause, and CDMO insolvency alike. Dual-sourcing: Acme funded a low-volume engineering run at a smaller regional CDMO every eighteen months, converting a theoretical “we could find another CDMO” option into an actively maintained second source with an estimated six-month, not fourteen-month, activation timeline.
Conclusion: all three contract terms initially scored High or Medium risk; all three were remediated before PPQ protocol approval. Recommendation: proceed, conditions closed.
Common inspection findings this assessment prevents
- A termination clause that promises only “reasonable assistance,” discovered to be unenforceable in practice only once an actual exit was already underway.
- Data or IP ownership language that was never tested against an insolvency scenario, leaving the sponsor’s rights ambiguous exactly when the CDMO is least able to cooperate.
- A termination notice period copied from a standard contract template, never checked against the specific modality’s realistic second-source transfer timeline.
- “Dual-sourcing” treated as a strategy discussion that never produced an actively maintained second source, a qualified-on-paper second source that would still take a full tech transfer cycle to activate.
How to adapt this assessment
- Read the actual termination, data-rights, and IP clauses in the master services agreement and technical agreement directly; do not accept a program manager’s summary of what they say.
- Score the termination notice period against a real, modality-specific transfer timeline estimate, not against what sounds reasonable in the abstract.
- For section 8, name the actual unit operations where a second source matters most, and be honest about whether “identified” means actively maintained or qualified-on-paper only.
- Where a gap is found before signature, negotiate it directly; where the contract is already signed, route the gap to Legal/Contracts for an amendment and to Quality Assurance for an interim risk acceptance.
- Revisit this assessment whenever the business-continuity risk assessment for this CDMO changes materially.
- Confirm every reference in section 10 against the current published version before issue.
