CDMO Financial Health and Business Continuity Risk Assessment

Document type	Risk Assessment
Topic area	CDMO Governance
Level	Advanced
Updated	October 2026

This is a ready-to-use risk assessment for a dimension a technical and quality audit routinely misses entirely: whether the CDMO, or the parent entity that owns it, is financially stable enough to still be running your process in two or three years. A site can score well on every technical and quality dimension in the paired CDMO Technical Assessment Scorecard and still close, get sold, or get reclassified internally as a non-core asset mid-program, for reasons that have nothing to do with its equipment or its quality system. This assessment is scoped separately from capacity-reservation and slot contract terms, covered in the main article’s Technical Assessment of a CDMO Before You Sign, not here. Replace every <<FILL: ...>> placeholder with your own specifics and route it through your normal document control, review, and approval. A worked filled specimen follows. Verify each cited reference against the current source before you rely on it.

Document control header

Field	Entry
Document title	Financial Health and Business Continuity Risk Assessment for `<<FILL: CDMO name>>`
Document number	`<<FILL: e.g. CDMO-FH-2026-01>>`
Version	`<<FILL>>`
Assessment date	`<<FILL>>`
CDMO and site(s) assessed	`<<FILL: name, site address, parent entity if different>>`
Linked technical assessment	`<<FILL: document number>>`
Document owner	`<<FILL: e.g. CMC Outsourcing Lead or Technical Operations Lead>>`

1. Purpose

This assessment evaluates the financial stability and business-continuity posture of <<FILL: CDMO name>> and, where different, its parent or ultimate owner, independently of the CDMO’s own assurances, so that a decision to rely on this site accounts for the risk that the business behind it closes, is sold, or deprioritizes the site during the life of the program.

2. Scope

Dimension	Decision
Entity assessed	`<<FILL: operating site, its direct corporate parent, and, where applicable, a private equity or other financial sponsor>>`
Information sources used	`<<FILL: e.g. public SEC filings, investor-day materials, trade press, direct questions to the CDMO>>`
Out of scope	Technical and quality capability, covered by the CDMO Technical Assessment Scorecard; capacity-reservation and slot contract terms, covered separately in the main article’s assessment sequence

3. Responsibilities

Role	Responsibility
CMC outsourcing lead / technical operations lead	Performs the assessment, compiles the indicator tables, drafts the conclusion
Legal / Contracts	Reviews whether an identified continuity risk is, or should be, addressed in the master services agreement and technical agreement
Quality Assurance	Confirms a documented risk acceptance exists for any indicator scored High
Regulatory / CMC	Assesses whether a continuity risk affects the sponsor’s own notification obligations under FD&C Act Section 506C
Executive sponsor	Receives the conclusion and owns the decision on whether the identified risk is proportionate to the program’s exposure

4. Methodology

Score each indicator against the evidence actually found, not the CDMO’s own assurance that “everything is fine.” Public financial disclosure exists only for a publicly traded CDMO or a publicly traded parent; for a privately held or financial-sponsor-owned site, rely on direct questions, corroborated wherever possible against trade press covering contract development and manufacturing, and treat a reluctance to answer a direct ownership or hold-period question as itself informative. This assessment does not require certainty that a site will never close or change hands; no diligence can promise that. It requires a documented answer naming the specific indicators checked and an explicit decision about whether the program’s exposure to this CDMO is proportionate to what independent verification actually found.

5. Scoring scale

Score	Meaning
High	A disclosed going-concern signal, confirmed active restructuring or site-closure activity at the specific site, or a direct refusal to answer basic ownership and continuity questions
Medium	No disclosed distress signal, but the site sits inside a segment or business unit with a declining revenue or margin trend, or an ownership structure, a financial sponsor nearing a typical hold-period exit, for example, that carries a real, foreseeable continuity question
Low	No adverse public disclosure, a stable or growing segment trend where disclosed, and a direct, credible answer on ownership, hold period, and the site’s classification as a core asset

6. Parent and ownership financial indicators

Indicator	Finding	Source	Score
Going-concern note or qualified audit opinion	`<<FILL>>`	`<<FILL: 10-K/10-Q section and date, or N/A if privately held>>`	`<<FILL>>`
Segment-level CDMO revenue and margin trend, prior 4 to 8 quarters	`<<FILL>>`	`<<FILL>>`	`<<FILL>>`
Ownership structure and, if financial-sponsor-owned, current hold period against the sponsor’s typical hold horizon	`<<FILL>>`	`<<FILL: direct question response, corroborated where possible>>`	`<<FILL>>`
Recent or pending M&A activity involving this entity or site	`<<FILL>>`	`<<FILL>>`	`<<FILL>>`

7. Site-specific continuity indicators

Indicator	Finding	Source	Score
Public restructuring, workforce reduction, or “strategic alternatives” language naming this site or its business unit	`<<FILL>>`	`<<FILL: trade press citation and date>>`	`<<FILL>>`
Site’s internal classification as a growth, maintain, or divest asset, escalated past the program manager if needed	`<<FILL>>`	`<<FILL>>`	`<<FILL>>`
Site-specific headcount and leadership turnover trend relevant to this program’s technical contacts	`<<FILL>>`	`<<FILL>>`	`<<FILL>>`

8. Regulatory continuity cross-check

A continuity risk at this CDMO is not only a schedule risk; for certain drug products it intersects a sponsor’s own notification obligation. Under FD&C Act Section 506C, an application holder must notify FDA of a permanent discontinuance, or an interruption likely to cause a meaningful supply disruption, in the manufacture of certain drug and biological products, generally at least six months in advance or, if that is not possible, as soon as practicable and no later than five business days after the interruption occurs. Section 506C(j), added by the CARES Act in March 2020, further requires certain manufacturers of drugs that are life-supporting, life-sustaining, intended to treat a debilitating disease or condition, or that would be considered critical in a public health emergency, to maintain a redundancy risk management plan evaluating supply risk at each manufacturing establishment; FDA’s draft guidance on these plans, “Risk Management Plans to Mitigate the Potential for Drug Shortages,” was published May 19, 2022, with its comment period closed July 19, 2022, and remained in draft as of this writing.

Question	Finding
Does this program’s product fall within Section 506C’s notification scope	`<<FILL>>`
If so, does Section 506C(j)‘s redundancy risk management plan requirement apply	`<<FILL>>`
Has the CDMO committed to supplying the site-specific continuity information a redundancy risk management plan requires	`<<FILL>>`
Sponsor’s own record-retention exposure under 21 CFR 211.180 if this site were to cease operating before the program’s records retention period lapses	`<<FILL>>`

9. Residual risk acceptance and conclusion

Field	Entry
Indicators scored High	`<<FILL>>`
Indicators scored High with no documented mitigation	`<<FILL: this blocks sign-off>>`
Overall recommendation	`<<FILL: proceed / proceed with conditions, e.g. a documented second-source contingency / hold pending further review>>`
QA risk acceptance reference, for any accepted gap	`<<FILL>>`

10. References

Federal Food, Drug, and Cosmetic Act, Section 506C, notification of a permanent discontinuance or interruption in manufacturing. Federal Food, Drug, and Cosmetic Act, Section 506C(j), redundancy risk management plans, added by the CARES Act, March 2020. FDA draft guidance, “Risk Management Plans to Mitigate the Potential for Drug Shortages” (May 19, 2022). 21 CFR 211.180, General requirements for records retention. ICH Q10, Pharmaceutical Quality System, management of outsourced activities.

Confirm the current version and status, draft versus final, of each reference before issue.

11. Revision history

Version	Date	Author	Summary of change
`<<FILL: 1.0>>`	`<<FILL>>`	`<<FILL>>`	Initial issue.

12. Approvals

Role	Name	Signature	Date
Author (CMC Outsourcing / Technical Operations)	`<<FILL>>`
Reviewer (Legal / Contracts)	`<<FILL>>`
Approver (Quality Assurance)	`<<FILL>>`

Filled specimen

Extract from an example assessment of a viral-vector CDMO for Acme Therapeutics’ ATX-520 AAV gene therapy program. Company and product are illustrative.

Indicator	Finding	Source	Score
Going-concern note or qualified audit opinion	None found	Parent’s most recent 10-K, filed `<<FILL: date>>`	Low
Segment-level CDMO revenue and margin trend	Parent’s cell and gene therapy manufacturing segment posted a third consecutive quarter of operating losses, per the parent’s most recent quarterly earnings call commentary	Quarterly earnings call transcript, `<<FILL: date>>`	Medium
Ownership structure and hold period	Publicly traded parent, no financial-sponsor ownership layer	N/A	Low
Site-specific restructuring language	Parent’s quarterly filing stated management was “evaluating strategic alternatives” for two of its six cell and gene therapy manufacturing sites; this site was not named as one of the two	Quarterly filing, `<<FILL: date>>`, and a follow-up direct question to the CDMO’s site leadership confirming this site was not among the two named	Medium, downgraded from High once the site-specific question was answered directly and confirmed

Conclusion: no indicator scored High, but the parent’s segment-level trend and the two-site strategic-alternatives disclosure, even though this site was not one of the two named, were judged close enough to the program’s exposure to warrant a documented mitigation rather than a clean pass. Recommendation: proceed with conditions. Acme negotiated an explicit tech-transfer-package delivery clause into the master services agreement and funded a low-volume engineering run at a smaller regional CDMO every eighteen months to keep a second source genuinely qualified, tracked in the paired CDMO Exit Readiness, Dual-Sourcing, and IP and Data Ownership Assessment.

Common inspection findings this assessment prevents

A technical assessment reaching a recommendation based entirely on equipment and quality evidence, with no independent check of the business behind the site.
A site-specific restructuring or “strategic alternatives” disclosure that was publicly available before signature but surfaced only after the program was already committed.
A financial-sponsor-owned CDMO’s hold period and exit incentive never discussed, despite being a direct, answerable question.
A continuity risk identified informally during diligence but never scored, mitigated, or risk-accepted in writing, so it quietly disappears from the program’s record.

How to adapt this assessment

For a publicly traded CDMO or parent, pull the actual 10-K/10-Q language and the segment-level numbers directly; do not summarize from memory or from a secondary source.
For a privately held or financial-sponsor-owned site, ask the ownership and hold-period question directly and in writing, and note explicitly if the CDMO declines to answer.
Search trade press covering contract development and manufacturing by the specific site name, not just the parent brand, before closing the assessment.
Score every indicator honestly against the scale in section 5, and route any High score through section 9 with a real owner, mitigation, and date.
Revisit this assessment at each periodic reassessment of the CDMO, since a continuity risk can emerge without the CDMO proactively disclosing it.
Confirm every reference in section 10 against the current published version, including whether the draft guidance cited has since been finalized, before issue.