How to use this document
Copy the template below into your quality system. Replace every <<FILL: ...>> placeholder with your company, system, and process specifics, then route it through your own document control, review, and approval. The filled specimen shows one worked example; adapt the numbers and scope to your operation and verify each cited regulation or standard against the current source before you rely on it.
This is a generic, originally worded starting point. It contains no confidential, proprietary, or employer material, it is drafted with AI assistance and reviewed, it is not legal or compliance advice, and adopting it does not by itself create or prove compliance. See the Disclaimer and Terms.
This is a ready-to-use risk assessment for the layer of suppliers sitting behind the CDMO itself: the manufacturers of single-use components and resins the CDMO’s own vendors source from, the sub-tier laboratories a CDMO’s outsourced testing actually runs in, and the service providers a critical piece of equipment depends on. A sponsor qualifies the CDMO as a third party; these are fourth parties, one layer further removed, and a technical assessment that stops at the CDMO’s front door never asks whether this layer is itself traceable and resilient. This assessment is scoped separately from biological starting materials, plasmid DNA, viral seed stock, and cell banks, which the paired Critical Starting Material and Raw Material Sourcing Risk Assessment already covers. Replace every <<FILL: ...>> placeholder with your own specifics and route it through your normal document control, review, and approval. A worked filled specimen follows. Verify each cited reference against the current source before you rely on it.
1. Purpose
This assessment identifies the CDMO’s own critical suppliers, single-use system and critical consumable manufacturers, outsourced analytical or calibration laboratories, and critical equipment service or spare-parts providers, confirms whether the CDMO can trace each one to the actual manufacturer or service provider rather than only to an intermediate distributor or broker, and scores the risk a sponsor inherits from that fourth-party layer.
2. Scope
3. Responsibilities
4. Methodology
Score each fourth-party dependency against three questions, not against whether the CDMO’s own certificate of analysis or service contract looks complete on its face: can the CDMO name the actual manufacturer or service provider behind its immediate supplier, does the CDMO receive advance notice of a manufacturing or formulation change at that actual-manufacturer level, and is there a confirmed alternate path, a second source or a backup service provider, if the current one fails. ICH Q7’s materials management section, written for active pharmaceutical ingredient manufacturing but a reasonable reference point here, sets the same underlying expectation this assessment is built around: an intermediate or API manufacturer buying through a distributor or broker is still expected to track the dependency back to whoever actually makes the material, rather than stopping at whichever name happens to appear on the purchase order or certificate of analysis. A CDMO that cannot answer that question for a given dependency has a gap regardless of how complete its paperwork otherwise looks.
5. Scoring scale
6. Single-use component, resin, and critical consumable risk table
7. Outsourced testing and calibration sub-tier check
Check a sub-tier testing laboratory’s regulatory standing the same way the main technical assessment checks the CDMO’s own standing; a sub-tier lab’s inspection history or import alert status reaches your program just as directly as the CDMO’s own does.
8. Critical equipment service and spare-parts dependencies
9. Residual risk acceptance and conclusion
10. References
ICH Q7, Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients, Section 7, Materials Management.
21 CFR 211.84, Testing and approval or rejection of components, drug product containers, and closures.
USP General Chapter <661>/<661.1>/<661.2>, Plastic Packaging Systems and Their Materials of Construction (extractables and leachables context for single-use components).
Confirm the current version of each reference before issue.
11. Revision history
12. Approvals
Filled specimen
Extract from an example assessment of a viral vector fill-finish CDMO for Acme Therapeutics’ ATX-520 AAV gene therapy program. Company and product are illustrative.
Outsourced testing check: sterility testing for this program is run at a sub-tier contract laboratory, not performed in-house by the CDMO. An independent check of that sub-tier lab’s FDA Inspection Classification Database history found no adverse classification; disposition closed, no further action, re-check at the next periodic reassessment.
Equipment service check: the bulk fill line’s automation controller carries a single-source service contract with the controller manufacturer, with no documented alternate service path. Scored Medium; the CDMO already carries a maintenance contract with guaranteed response time, judged sufficient on its own without requiring a second qualified service provider for this specific component.
Conclusion: one dependency, the cell processing bag, scored High with an open mitigation plan; recommendation is proceed with conditions, holding PPQ protocol approval until traceability confirmation or a qualified alternate component is in place.
Common inspection findings this assessment prevents
- A distributor’s certificate of analysis accepted as equivalent to knowing the actual manufacturer behind a critical single-use component or raw material.
- An outsourced test method run at a sub-tier laboratory whose own regulatory standing was never independently checked, inheriting its risk silently.
- A single-source equipment service dependency discovered only after the equipment actually fails, with no documented alternate path considered in advance.
- A fourth-party traceability gap identified in conversation during diligence but never scored, mitigated, or risk-accepted in writing.
How to adapt this assessment
- Build the dependency list in sections 6 through 8 directly from the CDMO’s actual bill of materials and service contracts, not from a generic list of consumable categories.
- Ask the traceability question, who is the actual manufacturer or provider, directly and in writing; do not accept “the supplier is qualified” as an answer to a different question.
- Score every dependency honestly against the scale in section 5, and route every High score with an open plan through section 9 with a real owner and date.
- Revisit this assessment at each periodic reassessment of the CDMO, since a fourth-party relationship can change without the CDMO proactively disclosing it.
- Confirm every reference in section 10 against the current published version before issue.
